Splunk Search

List Codes that are not in the lookup table

aquinojason
Path Finder

Hi,

I have a list of accounting codes in a lookup table. I use that to identify applications under that accounting code and . If the accounting code is not in the lookup table, it becomes "Others". How do I generate a report wherein the results will only list those "Others" and showing the accounting code used?

 

Thanks and Regards,

Labels (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

| where accountingCode="Others"

View solution in original post

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

| where accountingCode="Others"

0 Karma

aquinojason
Path Finder

Hi,

Thank you very much for the response and support. I have learned a lot from your answers.

 

0 Karma
Get Updates on the Splunk Community!

Index This | I’m short for "configuration file.” What am I?

May 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with a Special ...

New Articles from Academic Learning Partners, Help Expand Lantern’s Use Case Library, ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Your Guide to SPL2 at .conf24!

So, you’re headed to .conf24? You’re in for a good time. Las Vegas weather is just *chef’s kiss* beautiful in ...